CVE-2026-73646
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.
- Record
CVE-2026-73646- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2026-60239
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.
- Record
EUVD-2026-60239- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
NVD
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.
- Record
CVE-2026-73646- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.
- Record
CVE-2026-73646- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-73646
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.
- Record
DEBIAN-CVE-2026-73646- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2026:50287
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:50287- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 29 moreShow less
OSVRHSA-2026:54520
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:54520- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-73646
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.
- Record
UBUNTU-CVE-2026-73646- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1787592261 No score
TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.3.6-tuxcare.5.
- Record
CLSA-2026-1787592261- Updated
- 2026-11-02
OSVCLSA-2026-1790019520 No score
TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 7.0.32-tuxcare.3.
- Record
CLSA-2026-1790019520- Updated
- 2026-11-02
OSVCLSA-2026-1790023229 No score
TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 7.0.17-tuxcare.3.
- Record
CLSA-2026-1790023229- Updated
- 2026-11-02
OSVCLSA-2026-1790023231 No score
TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 5.2.18-tuxcare.3.
- Record
CLSA-2026-1790023231- Updated
- 2026-11-02
OSVCLSA-2026-1790089248 No score
TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.4.14-tuxcare.5.
- Record
CLSA-2026-1790089248- Updated
- 2026-11-02
OSVCLSA-2026-1790089252 No score
TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.4.5-tuxcare.4.
- Record
CLSA-2026-1790089252- Updated
- 2026-11-02
OSVCLSA-2026-1790089264 No score
TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.4.31-tuxcare.4.
- Record
CLSA-2026-1790089264- Updated
- 2026-11-02
OSVCLSA-2026-1790089280 No score
TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.4.41-tuxcare.5.
- Record
CLSA-2026-1790089280- Updated
- 2026-11-02
OSVCLSA-2026-1790089282 No score
TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.2.15-tuxcare.4.
- Record
CLSA-2026-1790089282- Updated
- 2026-11-02
OSVCLSA-2026-1790099843 No score
TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.5.6-tuxcare.5.
- Record
CLSA-2026-1790099843- Updated
- 2026-11-02
OSVCLSA-2026-1790102697 No score
TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.2.13-tuxcare.3.
- Record
CLSA-2026-1790102697- Updated
- 2026-11-02
OSVCLSA-2026-1790541900 No score
TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.5.17-tuxcare.1.
- Record
CLSA-2026-1790541900- Updated
- 2026-11-02
OSVCLSA-2026-1790604941 No score
TuxCare security update for postcss (6 CVEs)
TuxCare rebuilt postcss to address 6 CVEs. Fixed in 6.0.1-tuxcare.1.
- Record
CLSA-2026-1790604941- Updated
- 2026-11-02
OSVCLSA-2026-1791377049 No score
TuxCare security update for postcss (2 CVEs)
TuxCare rebuilt postcss to address 2 CVEs. Fixed in 7.0.14-tuxcare.4.
- Record
CLSA-2026-1791377049- Updated
- 2026-11-02
OSVCLSA-2026-1791377114 No score
TuxCare security update for postcss (2 CVEs)
TuxCare rebuilt postcss to address 2 CVEs. Fixed in 7.0.21-tuxcare.4.
- Record
CLSA-2026-1791377114- Updated
- 2026-11-02
OSVCLSA-2026-1791629015 No score
TuxCare security update for postcss (2 CVEs)
TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.5.3-tuxcare.2.
- Record
CLSA-2026-1791629015- Updated
- 2026-11-02
OSVCLSA-2026-1791629172 No score
TuxCare security update for postcss (2 CVEs)
TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.5.2-tuxcare.2.
- Record
CLSA-2026-1791629172- Updated
- 2026-11-02
OSVCLSA-2026-1791633202 No score
TuxCare security update for postcss (4 CVEs)
TuxCare rebuilt postcss to address 4 CVEs. Fixed in 8.4.49-tuxcare.1.
- Record
CLSA-2026-1791633202- Updated
- 2026-11-02
OSVCLSA-2026-1791832298 No score
TuxCare security update for postcss (2 CVEs)
TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.5.12-tuxcare.2.
- Record
CLSA-2026-1791832298- Updated
- 2026-11-02
OSVCLSA-2026-1792765677 No score
TuxCare security update for postcss (2 CVEs)
TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.5.14-tuxcare.1.
- Record
CLSA-2026-1792765677- Updated
- 2026-11-02
OSVCLSA-2026-1792765790 No score
TuxCare security update for postcss (3 CVEs)
TuxCare rebuilt postcss to address 3 CVEs. Fixed in 8.4.35-tuxcare.1.
- Record
CLSA-2026-1792765790- Updated
- 2026-11-02
OSVCLSA-2026-1792791822 No score
TuxCare security update for postcss (3 CVEs)
TuxCare rebuilt postcss to address 3 CVEs. Fixed in 8.2.9-tuxcare.2.
- Record
CLSA-2026-1792791822- Updated
- 2026-11-02
OSVCLSA-2026-1793097120 No score
TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.4.17-tuxcare.2.
- Record
CLSA-2026-1793097120- Updated
- 2026-11-02
OSVCLSA-2026-1793097204 No score
TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.4.33-tuxcare.2.
- Record
CLSA-2026-1793097204- Updated
- 2026-11-02
OSVCLSA-2026-1793125669 No score
TuxCare security update for postcss (2 CVEs)
TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.5.5-tuxcare.3.
- Record
CLSA-2026-1793125669- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12070-1 No score
velociraptor-0.76.7.0.git145.b60ef1146-1.1 on GA media
These are all security issues fixed in the velociraptor-0.76.7.0.git145.b60ef1146-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12070-1- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2026-73646 No score
CVE-2026-73646 in postcss - Patched by Root
Root has patched CVE-2026-73646 in the postcss package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-73646- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
postcssTuxCare:npm |
8.3.6-tuxcare.0 up to 8.3.6-tuxcare.5, plus listed versions 8.3.68.3.6-tuxcare.18.3.6-tuxcare.28.3.6-tuxcare.38.3.6-tuxcare.4 |
8.3.6-tuxcare.5 |
postcssTuxCare:npm |
7.0.32-tuxcare.0 up to 7.0.32-tuxcare.3, plus listed versions 7.0.327.0.32-tuxcare.17.0.32-tuxcare.2 |
7.0.32-tuxcare.3 |
postcssTuxCare:npm |
7.0.17-tuxcare.0 up to 7.0.17-tuxcare.3, plus listed versions 7.0.177.0.17-tuxcare.17.0.17-tuxcare.2 |
7.0.17-tuxcare.3 |
postcssTuxCare:npm |
5.2.18-tuxcare.0 up to 5.2.18-tuxcare.3, plus listed versions 5.2.185.2.18-tuxcare.15.2.18-tuxcare.2 |
5.2.18-tuxcare.3 |
postcssTuxCare:npm |
8.4.14-tuxcare.0 up to 8.4.14-tuxcare.5, plus listed versions 8.4.148.4.14-tuxcare.18.4.14-tuxcare.28.4.14-tuxcare.38.4.14-tuxcare.4 |
8.4.14-tuxcare.5 |
postcssTuxCare:npm |
8.4.5-tuxcare.0 up to 8.4.5-tuxcare.4, plus listed versions 8.4.58.4.5-tuxcare.18.4.5-tuxcare.28.4.5-tuxcare.3 |
8.4.5-tuxcare.4 |
postcssTuxCare:npm |
8.4.31-tuxcare.0 up to 8.4.31-tuxcare.4, plus listed versions 8.4.318.4.31-tuxcare.18.4.31-tuxcare.28.4.31-tuxcare.3 |
8.4.31-tuxcare.4 |
postcssTuxCare:npm |
8.4.41-tuxcare.0 up to 8.4.41-tuxcare.5, plus listed versions 8.4.418.4.41-tuxcare.18.4.41-tuxcare.28.4.41-tuxcare.38.4.41-tuxcare.4 |
8.4.41-tuxcare.5 |
postcssTuxCare:npm |
8.2.15-tuxcare.0 up to 8.2.15-tuxcare.4, plus listed versions 8.2.158.2.15-tuxcare.18.2.15-tuxcare.28.2.15-tuxcare.3 |
8.2.15-tuxcare.4 |
postcssTuxCare:npm |
8.5.6-tuxcare.0 up to 8.5.6-tuxcare.5, plus listed versions 8.5.68.5.6-tuxcare.18.5.6-tuxcare.28.5.6-tuxcare.38.5.6-tuxcare.4 |
8.5.6-tuxcare.5 |
Show 27 moreShow less
| Package | Affected | Fixed |
|---|---|---|
postcssTuxCare:npm |
8.2.13-tuxcare.0 up to 8.2.13-tuxcare.3, plus listed versions 8.2.138.2.13-tuxcare.18.2.13-tuxcare.2 |
8.2.13-tuxcare.3 |
postcssTuxCare:npm |
8.5.17-tuxcare.0 up to 8.5.17-tuxcare.1, plus listed versions 8.5.17 |
8.5.17-tuxcare.1 |
postcssTuxCare:npm From an advisory covering 6 CVEs |
6.0.1-tuxcare.0 up to 6.0.1-tuxcare.1, plus listed versions 6.0.1 |
6.0.1-tuxcare.1 |
postcssTuxCare:npm |
7.0.14-tuxcare.0 up to 7.0.14-tuxcare.4, plus listed versions 7.0.147.0.14-tuxcare.17.0.14-tuxcare.27.0.14-tuxcare.3 |
7.0.14-tuxcare.4 |
postcssTuxCare:npm |
7.0.21-tuxcare.0 up to 7.0.21-tuxcare.4, plus listed versions 7.0.217.0.21-tuxcare.17.0.21-tuxcare.27.0.21-tuxcare.3 |
7.0.21-tuxcare.4 |
postcssTuxCare:npm From an advisory covering 2 CVEs |
8.5.3-tuxcare.0 up to 8.5.3-tuxcare.2, plus listed versions 8.5.38.5.3-tuxcare.1 |
8.5.3-tuxcare.2 |
postcssTuxCare:npm From an advisory covering 2 CVEs |
8.5.2-tuxcare.0 up to 8.5.2-tuxcare.2, plus listed versions 8.5.28.5.2-tuxcare.1 |
8.5.2-tuxcare.2 |
postcssTuxCare:npm From an advisory covering 4 CVEs |
8.4.49-tuxcare.0 up to 8.4.49-tuxcare.1, plus listed versions 8.4.49 |
8.4.49-tuxcare.1 |
postcssTuxCare:npm From an advisory covering 2 CVEs |
8.5.12-tuxcare.0 up to 8.5.12-tuxcare.2, plus listed versions 8.5.128.5.12-tuxcare.1 |
8.5.12-tuxcare.2 |
postcssTuxCare:npm From an advisory covering 2 CVEs |
8.5.14-tuxcare.0 up to 8.5.14-tuxcare.1, plus listed versions 8.5.14 |
8.5.14-tuxcare.1 |
postcssTuxCare:npm From an advisory covering 3 CVEs |
8.4.35-tuxcare.0 up to 8.4.35-tuxcare.1, plus listed versions 8.4.35 |
8.4.35-tuxcare.1 |
postcssTuxCare:npm From an advisory covering 2 CVEs |
8.2.9-tuxcare.0 up to 8.2.9-tuxcare.2, plus listed versions 8.2.98.2.9-tuxcare.1 |
8.2.9-tuxcare.2 |
postcssTuxCare:npm |
8.4.17-tuxcare.0 up to 8.4.17-tuxcare.2, plus listed versions 8.4.178.4.17-tuxcare.1 |
8.4.17-tuxcare.2 |
postcssTuxCare:npm |
8.4.33-tuxcare.0 up to 8.4.33-tuxcare.2, plus listed versions 8.4.338.4.33-tuxcare.1 |
8.4.33-tuxcare.2 |
postcssTuxCare:npm From an advisory covering 2 CVEs |
8.5.5-tuxcare.0 up to 8.5.5-tuxcare.3, plus listed versions 8.5.58.5.5-tuxcare.18.5.5-tuxcare.2 |
8.5.5-tuxcare.3 |
node-postcssDebian:12 |
All versions, plus listed versions 8.4.20+~cs8.0.23-18.4.20+~cs8.0.23-1+deb12u18.4.31+~cs8.0.26-18.4.39+~cs9.2.29-18.4.49+~cs9.2.32-1 Show 14 moreShow less8.5.12+~cs9.3.32-18.5.14+~cs9.3.34-18.5.15+~cs9.3.34-18.5.15+~cs9.3.38-18.5.15+~cs9.3.39-18.5.19+~cs10.2.23-18.5.21+~cs10.2.23-18.5.23+~cs10.2.23-18.5.25+~cs10.2.23-18.5.26+~cs10.2.24-18.5.28+~cs10.2.24-18.5.6+~cs9.3.28-18.5.8+~cs9.3.30-18.5.9+~cs9.3.30-1 |
None known |
node-postcssDebian:13 |
All versions, plus listed versions 8.4.49+~cs9.2.32-18.5.12+~cs9.3.32-18.5.14+~cs9.3.34-18.5.15+~cs9.3.34-18.5.15+~cs9.3.38-1 Show 10 moreShow less8.5.15+~cs9.3.39-18.5.19+~cs10.2.23-18.5.21+~cs10.2.23-18.5.23+~cs10.2.23-18.5.25+~cs10.2.23-18.5.26+~cs10.2.24-18.5.28+~cs10.2.24-18.5.6+~cs9.3.28-18.5.8+~cs9.3.30-18.5.9+~cs9.3.30-1 |
None known |
node-postcssDebian:14 |
before 8.5.19+~cs10.2.23-1, plus listed versions 8.4.49+~cs9.2.32-18.5.12+~cs9.3.32-18.5.14+~cs9.3.34-18.5.15+~cs9.3.34-18.5.15+~cs9.3.38-1 Show 4 moreShow less8.5.15+~cs9.3.39-18.5.6+~cs9.3.28-18.5.8+~cs9.3.30-18.5.9+~cs9.3.30-1 |
8.5.19+~cs10.2.23-1 |
prometheus3.13Red Hat:hummingbird:1 From an advisory covering 4 CVEs |
before 0:3.13.2-0.2.hum1 | 0:3.13.2-0.2.hum1 |
prometheus3.5Red Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:3.5.5-0.8.hum1 | 0:3.5.5-0.8.hum1 |
postcssRoot:npm |
before 8.4.49-aikido.4 | 8.4.49-aikido.46.0.1-aikido.28.4.38-aikido.28.5.3-aikido.38.4.21-aikido.28.5.15-aikido.27.0.39-aikido.78.5.8-aikido.55.2.18-aikido.57.0.32-aikido.18.4.32-aikido.17.0.36-aikido.18.5.6-aikido.56.0.23-aikido.38.4.31-aikido.4 |
@rootio/postcssRoot:npm |
before 8.4.49-root.io.4 | 8.4.49-root.io.46.0.1-root.io.28.4.38-root.io.28.5.3-root.io.38.4.21-root.io.28.5.15-root.io.27.0.39-root.io.78.5.8-root.io.55.2.18-root.io.57.0.32-root.io.18.4.32-root.io.17.0.36-root.io.18.5.6-root.io.56.0.23-root.io.38.4.31-root.io.4 |
node-postcssUbuntu:20.04:LTS |
All versions, plus listed versions 6.0.23-16.0.23-3 |
None known |
node-postcssUbuntu:22.04:LTS |
All versions, plus listed versions 8.2.1+~cs5.3.23-88.4.5+~cs7.1.51-28.4.6+~cs7.3.21-1 |
None known |
node-postcssUbuntu:24.04:LTS |
All versions, plus listed versions 8.4.20+~cs8.0.23-18.4.31+~cs8.0.26-1 |
None known |
node-postcssUbuntu:26.04:LTS |
All versions, plus listed versions 8.5.6+~cs9.3.28-18.5.8+~cs9.3.30-1 |
None known |
velociraptoropenSUSE:Tumbleweed From an advisory covering 40 CVEs |
before 0.76.7.0.git145.b60ef1146-1.1 | 0.76.7.0.git145.b60ef1146-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-73646 is a high vulnerability (CVSS 7.5) in Postcss, published August 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 45th percentile. Fixed in postcss 8.3.6-tuxcare.5.
References
github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849
nvd.nist.gov/vuln/detail/CVE-2026-73646
security-tracker.debian.org/tracker/CVE-2026-73646
Show 73 moreShow less
access.redhat.com/errata/RHSA-2026:50287
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50287.json
bugzilla.redhat.com/show_bug.cgi?id=2510719
cve.org/CVERecord?id=CVE-2026-69153
vulncheck.com/advisories/go-chi-chi-ip-spoofing-via-x-forwarded-for-header
ubuntu.com/security/CVE-2026-73646
suse.com/security/cve/CVE-2025-0914